CVE-2026-115231: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module…

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

CVE-2026-114185: WPVibes AnyWhere Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

CVE-2026-111751: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each...

CVE-2026-111754: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-76955: Zyxel NWA110AX firmware: A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could…

A buffer overflow vulnerability in the zdpwtp binary in Zyxel NWA110AX firmware versions through 7.12ABTG.0C0 could allow a LAN-based attacker to escalate privileges on an affected device...

CVE-2026-76894: ondata ckan-mcp-server: CKAN MCP Server is a tool for querying CKAN open data portals

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that...

CVE-2026-77777: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow…

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials...

CVE-2026-77800: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers…

ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider...

CVE-2026-82159: Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page…

Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-89293: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker…

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnesti...

CVE-2026-89229: vivo BlueLM Copilot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM…

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in the ShareActivity component of BlueLM Copilot com.vivo.ai.copilot allows a malicious application installed on the same device to write arbitrary files via a crafted ACTIONSEND intent with a ContentProvider-supplied fi...

CVE-2026-95735: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper certificate validation vulnerability exists in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials...

CVE-2026-121224: Google Chrome: Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had…

Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-105770: octo-sts app: Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does…

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-121119: Google Chrome: Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-115541: HumHub HumHub Community Edition: HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation…

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded...

CVE-2026-121113: Google Chrome: Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-121200: Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…

Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95732: Hewlett Packard Enterprise (HPE) Fabric Composer: An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system...

CVE-2026-95769: Hewlett Packard Enterprise (HPE) Fabric Composer: An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer

An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records...